XDR-Engineer Maintenance And Troubleshooting Practice Question
An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check if the SIEM requires mutual TLS (mTLS) authentication and ensure valid client certificates are configured on the Broker VM.
SIEM forwarding troubleshooting involves verifying network connectivity, TLS/certificate parameters, and destination port accessibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check if the SIEM requires mutual TLS (mTLS) authentication and ensure valid client certificates are configured on the Broker VM.
Why this is correct
mTLS configuration mismatches will cause handshake rejections and connection timeouts.
- ✓
Examine the Broker VM export logs for queue backups or delivery error responses from the SIEM receiver.
Why this is correct
Log inspection reveals whether the SIEM is actively rejecting payloads or dropping connections.
- ✓
Verify that the destination SIEM listener IP address and port are reachable from the Broker VM using network tools like nc or telnet.
Why this is correct
Network reachability testing confirms that intermediate firewalls permit traffic to the SIEM listener.
- ✗
Restart the Cortex XDR management console web server.
Why it's wrong here
Administrators cannot restart the cloud-hosted Cortex XDR management console web server.
- ✗
Reinstall the Windows operating system on the SIEM receiver.
Why it's wrong here
Reinstalling the OS on the SIEM is an extreme and irrelevant troubleshooting step.
About these practice questions
Courseiva writes every XDR-Engineer question from scratch — 226 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XDR-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XDR-Engineer exam.